180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload_2026-04-17_10-15-57-336736.exe
Size 3.0MB
Sample260418-yr9cpsew2w
SHA256 180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393
MD5 893a4400d0ac1a50fcbb5eb2c18382b8
SHA1 8176000428800beb055f12ed690fb6e45a187ab8
SHA512 7283199446e7f7e95d4bac71e23a810b03d192eb0709ae2d189ce7ce1f0738847cfb05338d104ad531503eb7b31ff93d39aece8a241014edd241fe466f5accf8
SSDEEP 49152:U/5vgQsBZrRf8tGJ2wM9Hlne9tZBR2ooR99f7d5NatnXjueXQpkpnWkKoXT3:UsRfd2fne91K7co
TLSH
T14BE5BE5AD19360EECC2AC170634B6132FE3474599D387E6B7694CB393EB0D603A59F28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	payload_2026-04-17_10-15-57-336736.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	payload_2026-04-17_10-15-57-336736.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	payload_2026-04-17_10-15-57-336736.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	payload_2026-04-17_10-15-57-336736.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4376	chrome.exe
4616	msedge.exe
4616	msedge.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe
4524	payload_2026-04-17_10-15-57-336736.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4376	4524	payload_2026-04-17_10-15-57-336736.exe	85
PID 4524 wrote to memory of 4376	4524	payload_2026-04-17_10-15-57-336736.exe	85
PID 4524 wrote to memory of 4616	4524	payload_2026-04-17_10-15-57-336736.exe	88
PID 4524 wrote to memory of 4616	4524	payload_2026-04-17_10-15-57-336736.exe	88

C:\Users\Admin\AppData\Local\Temp\payload_2026-04-17_10-15-57-336736.exe
"C:\Users\Admin\AppData\Local\Temp\payload_2026-04-17_10-15-57-336736.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 12acd60422857436f9f6246548c46d97821129af04e79d4103d745cc4e13436c
MD5 bd6ed3ce93e041df862705a29066cb59
SHA1 41114483d5553241f8f98a59e8d26e365fe20d7b
SHA512 31e36ab58937be93e7db6df169c871d173b9fc9f4d1157e6712309186ea1aa3f9c7d4ae152c6f1b708939093ae8ffb74c4d2e879d4527546a1177c6f42b1fa7e
SSDEEP 96:i/PdB5/q/6G/eG/t/YImjmgdmpGmqmjvGe/OuufE3dJLdzdodOCdIfmnIfnf3ff7:ov5Tr2CszzvPH/GwKZC
TLSH
T11591AC0699D9CE0F6780E8E39772E16C85F088487F8837219BA588CD79C680DF5C6797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 593B
SHA256 a78d2a2468da28f8da7152f29fab883e3aa9ae22a2339ea36febe7110aa92ea8
MD5 b30ce52501012b16d7802f5c6bf09153
SHA1 dbaae2ff570f413555aba8d3a3397fb827df6462
SHA512 f24a8d236e5535ff2a43ee510dd927305d47ed1eabfbfc654beacb1584006d7f186a6f1631c2366d84b964cb11c890cda1988ac78552eb692738c533212949b0
TLSH
T1BAF04C43BCC6981E1150DCE7D351776C9CE940089F9A27479B44C48C75C591DF9CB3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 255B
SHA256 4134aa0ccfe2ad2fbb9c80d2eb5b1e172da3ef13b66b12ffd3fc2d35a1c9da72
MD5 f195a9d65e069af5c11691500af1ee3b
SHA1 750df66798a73f862d018eb5794e0886d47150d3
SHA512 86fb5c4c9e761404a3b04fbddf4f17c7011b021f0520effe6c4b6d20401f1a11784e5cb85ed60262a1028e9207158287d08a165913f5e4d3d50b0fc3c2b02759
TLSH
T1CED09712EC82C48C2562E8B7C300269CDCFB4118AB590303BB85804D14C0F0C9CCB3E6
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1018B
SHA256 1cd1da8bfa691df77e3ec2008cf869a51c856326a5b77f7f2f2142c36a2e3345
MD5 bf3efce6bd51b6bd8602a0844bcdd8b5
SHA1 2a9239d45d424106ce271027c33e9626442f578e
SHA512 b283039388f2dc8caeae6d4538d10d8b55b60a2b31963617d49fcc6e8d7da02fe7e5395c5a021972bd3a30cc608c3fe90246a7202dde8d4e0582ff8e778011a1
TLSH
T186117B02BCC5D82E1140ECE39361B76C9CE484049BCE2B439B84E94C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 d780ac2fcdef7a16f7f11dd3b747d70454f75f24fbb847e43642efd1fd4992e8
MD5 9976f050bc5fff22b71db39129dcc0c1
SHA1 b8f90dba399715696d409b40c2f6736215d0e979
SHA512 f6e5b1218e0d96cbdcd1010670d60c24308fb3157dc1b25bef1e2e2efff6df471ad4638170c0e37f662426e553d3dbf33c90febf6faee085a0d300b47232c5ad
TLSH
T16B118B02FCC5D81E1140E8E39350B66C9CF484089BCE2B429784D94C75C581EB6CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 1a83bad5af35966e20ea7cbda2bed1310dfc7db477f18d1ec6127159e9629d30
MD5 e827bcf1c8b5f705a7a68751b812cbd5
SHA1 228e20e4f954259a4e48904116058fde54b2cac8
SHA512 0dad7d9e90cb4b48941f6c83a7f7bb1202d2aac0d6197c003eef8586353846030384aff45408556ae979f1a9c2e7b4045f4f3bafeff0b98191419a01c82be029
TLSH
T199318B02F8C6D81E1110ECD39354BA6C98F98448ABCE3B425B84C84CB5C695EF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 7bcd61d401544c20ba43dd4da78b2658b40b7ddd018215303a43a87ba82f6e9b
MD5 6fcd19c280c9cabed9bb09f31757e1e7
SHA1 4c46dec489c619eb069ff8d41399e06f42ba3658
SHA512 e1f84a1a7ba424be685c7e219bd4691a76de83f8cadf669c4f4bb53c1ab79762839c9c66d714d8c188d16c46599313408406b7d9255eb3987eb2c1e9857d9d8b
TLSH
T1C8318A02F8C6D82E6110FCD39354BA6C98E48449ABCE3B425B84DC4CB58295EF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 81698e6bd54628ece11d092392f13dc26843156be2044ac74960f43fbce003fe
MD5 81e1e06834f6907fe45699a923fe2ad2
SHA1 9f835a5e09280628f948216eecfdd539f5c4cdd3
SHA512 7bcd02df25c78f4cb87d9462ffbabd720100086556320c1f475313c364f6cd85b5cbc1cd7389ab07fd9e793453c0869546d6d332ac1c75a19d0e6286ba5ca1a7
TLSH
T18A41BB02F8C5D81E1110B8D3D355AA2C98E484599BCE3B025B88D88CB9C696BF6CF397
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 d99d04bb501681f199bb43eaa4b965f8294f5fced7713b20e238516240f8f737
MD5 d3f1f1642530d81dd82aa0f2c9ff67f4
SHA1 076ac1ac6121a9ee9c614dd67a91969b4c5d0a79
SHA512 b2cb598af3dd9c3378695f4457361726167d2283170eec3975cda80d9ae544cc8a05220e63da8c2bf3b1fe54880db5b6b3147bfdb16c65884450d926c5db5d02
TLSH
T14941E042F8C5D81E1210BCD3E341A61C88E454599BCD3B025B89C88C79CA56BB7CF3A7
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 3KB
SHA256 5ba8db548355ed3614bf52067c6fefbca4bdc4300fbedddda8159d483f4e56ef
MD5 7ef99786e352b8a5a9c56b88c65b7954
SHA1 145af448ddad64ad0b3781ec8196b22cbd52ab4e
SHA512 b6db238f9c2c7f1ad88136fb41f3be2277821257359cda55ff0f081f107d2b361077147940a54357d8eb808451a9ec711425d27313ecc2e27b42fea263c122c7
TLSH
T1E261DC0798D5C90F2390E8E3D371E21C89E08C486FCD37215B99C88D78C685EE6CA797
MD5 SHA1 SHA512 TLSH

Submit Download

pwd_4516.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_4516.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwd_4800.db

Path C:\Users\Admin\AppData\Local\Temp\pwd_4800.db
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4524-185-0x0000021DD30D0000-0x0000021DD3271000-memory.dmp

Download

memory/4524-184-0x00007FF6BA020000-0x00007FF6BBCD1000-memory.dmp

Download

memory/4524-187-0x00007FF6BA020000-0x00007FF6BBCD1000-memory.dmp

Download

memory/4524-192-0x0000021DD30D0000-0x0000021DD3271000-memory.dmp

Download

memory/4524-191-0x00007FF6BA020000-0x00007FF6BBCD1000-memory.dmp

Download

memory/4588-49-0x000001C62A0F0000-0x000001C62A291000-memory.dmp

Download

memory/4768-39-0x000002345E200000-0x000002345E3A1000-memory.dmp

Download